[fly602]

修复内容

CWE-78 命令注入风险

对 appwiz.cpp 中从 .desktop 文件 X-Deepin-PreUninstall 字段读取的预卸载脚本增加执行前校验：

新增校验

1. 绝对路径校验：脚本路径必须是绝对路径，防止路径劫持
2. 存在性与可执行性校验：脚本文件必须存在且具有可执行权限

原代码

直接从 .desktop 文件读取 X-Deepin-PreUninstall 字段并执行，恶意/被篡改应用包可通过该字段注入任意命令。

修复后

QFileInfo scriptInfo(args[0]);
if (!scriptInfo.isAbsolute()) {
    qCWarning(...) << "Pre-uninstall script path is not absolute, aborting:" << args[0];
    return;
}
if (!scriptInfo.exists() || !scriptInfo.isExecutable()) {
    qCWarning(...) << "Pre-uninstall script does not exist or is not executable, aborting:" << args[0];
    return;
}

Log: add absolute path and executability validation for PreUninstall script
Influence: fix CWE-78 command injection risk from .desktop file X-Deepin-PreUninstall field

Summary by Sourcery

Bug Fixes:

• Validate pre-uninstall script paths from desktop files before execution to prevent command injection risks.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fly602

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds pre-execution validation for the X-Deepin-PreUninstall script path, requiring an absolute, existing, executable file and aborting with warnings otherwise, mitigating command-injection and path-hijacking risks from crafted .desktop files.

Sequence diagram for validated pre-uninstall script execution

sequenceDiagram
    participant DesktopFile
    participant AppWiz
    participant QFileInfo
    participant Process

    DesktopFile->>AppWiz: legacyRequestUninstall(desktopFileFullPath)
    AppWiz->>AppWiz: Read X-Deepin-PreUninstall
    AppWiz->>QFileInfo: isAbsolute()
    alt path is not absolute
        AppWiz-->>AppWiz: qCWarning and return
    else absolute path
        AppWiz->>QFileInfo: exists()
        AppWiz->>QFileInfo: isExecutable()
        alt missing or not executable
            AppWiz-->>AppWiz: qCWarning and return
        else valid executable
            AppWiz->>Process: start(args[0], args.mid(1))
        end
    end

Loading

File-Level Changes

Change	Details	Files
Validate the pre-uninstall executable path before launching it.	Reject paths that are not absolute. Reject scripts that are missing or lack executable permissions. Log security warnings and abort uninstallation when validation fails. Preserve existing support for launching scripts with or without arguments after validation.	src/ddeintegration/appwiz.cpp

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[deepin-ci-robot]

deepin pr auto review

🤖 AI 代码审查报告

总体评分： 100 分 (通过阈值: 70分)

---

📊 总体评价

项目	结果
审查结论	代码审查通过
评分详情	本次提交是对 CWE-78 命令注入漏洞的安全修复，在执行 X-Deepin-PreUninstall 脚本前增加了路径验证（绝对路径检查、文件存在性检查、可执行权限检查）。语法逻辑正确，代码质量良好（注释完整、日志适当），性能影响极小，且未引入新的安全漏洞。OCR 提出的两点均为防御深度建议而非实际漏洞。

---

🔍 详细分析

1. 语法逻辑 ✅

评价： 语法正确，逻辑清晰 ✅ 通过

潜在问题：
✅ 未发现明显问题

建议： []

---

2. 代码质量 ✅

评价： 代码结构清晰，注释完整 ✅ 通过

潜在问题：
✅ 未发现明显问题

建议： []

---

3. 代码性能 ✅

评价： 性能良好，资源使用合理 ✅ 通过

潜在问题：
✅ 未发现明显问题

建议： []

---

4. 代码安全 🔒

评价： 存在0个安全漏洞 ✅ 通过

🔐 发现 0 个安全漏洞

安全漏洞详情：
✅ 未发现安全漏洞

建议： ['建议1: 可考虑额外检查 scriptInfo.isSymLink() 并拒绝符号链接，以消除 TOCTOU 竞态条件（OCR 建议，防御深度加固）', '建议2: 可考虑使用 QProcess::start(program, args) 形式而非字符串形式，进一步避免 QProcess::splitCommand 的潜在拆分风险（OCR 建议，防御深度加固）']

---

💡 改进建议代码示例

// 防御深度加固版本（可选）：
QFileInfo scriptInfo(args[0]);
if (!scriptInfo.isAbsolute()) {
    qCWarning(logDdeIntegration) << "Pre-uninstall script path is not absolute, aborting:" << args[0];
    return;
}
// 可选：拒绝符号链接以防 TOCTOU 竞态
if (scriptInfo.isSymLink()) {
    qCWarning(logDdeIntegration) << "Pre-uninstall script path is a symlink, aborting:" << args[0];
    return;
}
if (!scriptInfo.exists() || !scriptInfo.isExecutable()) {
    qCWarning(logDdeIntegration) << "Pre-uninstall script does not exist or is not executable, aborting:" << args[0];
    return;
}

if (args.size() == 1) {
    process.start(args[0]);
} else {
    process.start(args[0], args.mid(1));
}

---

本报告由 AI 代码审查工具自动生成